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DETAILED ACTION 

1 . Claims 1-32 are pending in this office action. Claims 1-32 are presented for 
examination. This office action is in response to the filling dated 1/26/2001 . 



Claim Rejections - 35 USC § 102 

2. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

(e) the invention was described in- 

(1) an application for patent, published under section 122(b), by another filed in the United States 
before the invention by the applicant for patent, except that an international application filed under the 
treaty defined in section 351(a) shall have the effect under this subsection of a national application 
published under section 122(b) only if the international application designating the United States was 
published under Article 21 (2)(a) of such treaty in the English language; or 

(2) a patent granted on an application for patent by another filed in the United States before the 
invention by the applicant for patent, except that a patent shall not be deemed filed in the United 
States for the purposes of this subsection based on the filing of an international application filed under 
the treaty defined in section 351(a). 

3. Claims 1-4, 6-9, and 28-31 are rejected under 35 U.S.C. 102(e) as being 
anticipated by Ananda (US 6385731 B2). 

With respect to claims 1 and 28, a method of controlling access to records stored 
in a database, said method comprising: defining at least one expression associated with 
at least one record of said database, (col. 3, lines 18-34, one expression is a user 
password); evaluating said at least one expression for said at least one record, (col. 3, 
lines 18-34, Ananda shows the user validation module compares the password with the 
password stored in the user registration database for the user); and allowing access to 
said at least one record based on said evaluating of said at least one expression, (col. 
3, lines 18-34, Ananda shows when the password is validated, the controller of the 
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central rental facility establishes continuous connection; otherwise, communications 
with the remote computer are terminated). 

As to claim 2, a method as recited in claim 1, wherein said at least one 
expression is a calculation expression that can be evaluated at least partly based on a 
value of at least one field of said at least one record, (col. 3, lines 18-34). 

As to claim 3, a method as recited in claim 1 , wherein said at least one 
expression is a calculation expression that can be evaluated at least partly based on at 
least one state variable of said database, (col. 3, lines 18-34). 

As to claims 4 and 29, a method as recited in claim 1 , wherein said at least one 
expression can be defined based on fields and state variables of said database, and 
wherein said evaluating operates to return only one of two possible values, one of said 
possible values indicating that access to said at least one record should be granted, and 
the other one of said possible values indicating that access to said at least one record 
should be denied, (col. 3, lines 18-34). 

As to claim 6, a method as recited in claim 1 , wherein said defining of said at 
least one expression defines access privileges for a user of said database with respect 
to accessing one or more records of said database, (col. 3, lines 18-34). 
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As to claim 7, a method as recited in claim 1, wherein said defining of said at 
least one expression operates to define access privileges for a user of said database 
with respect to at least one operation that can be performed on one or more records of 
said database, (col. 3, lines 18-34). 



As to claims 8 and 30, a method as recited in claim 1 , wherein said defining of 
said expression defines access privileges for at least one user of said database with 
respect to access to one or more records in said database, (col. 3, lines 18-34), and 
wherein said defining of said expression operates to define access privileges with 
respect to at least one operation that may be requested to be performed by said at least 
one user on one or more records of said database, (col. 3, lines 18-34). 

As to claims 9 and 31 , a method as recited in claim 8, wherein said at least one 
user is assigned a password that is associated with said expression, (col. 3, lines 18- 
34). 

4. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public 
use or on sale in this country, more than one year prior to the date of application for patent in the United 
States. 

5. Claims 16-27 are rejected under 35 U.S.C. 102(b) as being anticipated by Balint 
et al. (US 5542024). 
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With respect to claim 16, Balint discloses a database system, said database 
system comprising: a database having one or more records stored therein, (col. 22, 
lines 27-48); a database program including a Graphical User Interface that can be used 
to facilitate operations on said one or more records stored in said database, (col. 22, 
lines 27-48); and wherein said Graphical User Interface operates to facilitate defining 
access privileges with respect to said one or more records stored in said database, (col. 
22, lines 27-48). 

As to claim 17, a database system as recited in claim 16, wherein said Graphical 
User Interface operates to provide the ability for a user of said database to define an 
expression associated with at least one operation that may be requested to be 
performed by another user of said database on said one or more records stored in said 
database, (col. 22, lines 27-48). 

As to claim 18, a database system as recited in claim 16, wherein said Graphical 
User Interface operates to provide the ability for a user to define said expression without 
requiring said user to write a programming script, (col. 22, lines 27-48). 

As to claim 19, a database system as recited in claim 16, wherein said Graphical 
User Interface provides a window that allows a user to interact with said Graphical User 
Interface to identify a password for which access privileges may be defined or re- 
defined, (col. 22, lines 27-48). 
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As to claim 20, a database system as recited in claim 19, wherein said Graphical 
User Interface further provides a window that allows a user to specify a calculation 
expression which defines access privileges with respect to at least one operation that 
may be requested to be performed on said one or more records, (col. 22, lines 27-48). 

As to claims 21 and 26, a database system as recited in claim 20, wherein said 
at least one operation can be a browse, edit, or a delete operation, (col. 3, lines 16-21). 

As to claim 22, a database system as recited in claim 20, wherein said 
calculation expression can be evaluated at least partly based on a value in at least one 
field of said one or more records of said database, and wherein said calculation 
expression can be evaluated at least partly based on at least one state variable of said 
database, (col. 22, lines 16-21). 

As to claim 23, a database system as recited in claim 16, wherein said database 
program operates to determine whether access to at least one of said one or more 
records should be granted or denied, (col. 22, lines 27-48). 

As to claim 24, a database system as recited in claim 23, wherein said 
determining of whether access to said at least one record should be granted or denied 
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is performed by evaluating a calculation expression for said at least one of said one 
record, (col. 22, lines 27-48). 

As to claim 25, a database system as recited in claim 24, wherein access to said 
at least one record is granted only when said determining determines that access 
should be granted, and wherein access to said at least one record is denied when said 
determining determines that access should be denied for said record, (col. 22, lines 27- 
48). 

As to claim 27, a database system as recited in claim 24, wherein said database 
system further comprises a cache, and wherein said cache operates to store an 
evaluated result of at least one calculation expression, (col. 22, lines 27-48). 

Claim Rejections - 35 USC § 103 

6. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

7. Claims 5 and 11-15 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Ananda (US 6385731 B2) in view of Schaefer et al. (US 5826268). 
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As to claim 5, Ananda does not explicitly teach, "a method as recited in claim 1, 
wherein said evaluation is performed only when a request to access said at least one 
record has been received." 

However, Schaefer shows the record on "James Bond" may be visible at level U, 
and at level U we can see a set of "MI-6 employee". However, the fact the Bond works 
for MI-6 is a member of the employee set, should be visible only at level S or above. 
The fact that Bond is infiltrating may be classified T so that the Bond record appears in 
both set. Such invisible super types help to preserve data confidential, (col. 10, lines 3- 
15). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to employ the teaching of Ananda with the teaching of 
Schaefer because many databases containing sensitive data are likely to be accessible 
through a computer network or internet work, thereby exposing those databases to 
entities which may attempt to comprise the confidential of the sensitive data. 

With respect to claim 1 1 , Ananda discloses a method of controlling access to 
records stored in a database, said method comprising: identifying a password that is 
associated with one or more users of said database, (col. 3, lines 19-34); receiving a 
request to perform said at least one operation on one or more records of said database, 
said request being identified as a request made by said one or more users associated 
with said password, (col. 3, lines 19-34); evaluating said calculation expression when 
said request has been received, (col. 3, lines 19-34); said evaluation returning only one 
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of two possible values, one of said to possible values indicating that said at least one 
operation should be granted and another one of said possible values indicating that said 
at least one operation should be denied, (col. 3, lines 19-34); granting said at least one 
operation to be performed when said evaluation returns one said possible value to 
Indicate that said at least one operation should be granted, (col. 3, lines 19-34) ; and 
denying said at least one operation to be performed when said evaluation returns one 
said another possible value to indicate that said at least one operation should be 
denied, (col. 3, lines 19-34). 

Ananda does not clearly disclose "defining a calculation expression for said 
identified password, said calculation expression defining access privileges of said one 
or more users with respect to at least one operation that may be requested to be 
performed by said one or more users on one or more records of said database." 

However, Schaefer shows the record on "James Bond" may be visible at level U, 
and at level U we can see a set of "MI-6 employee". However, the fact the Bond works 
for MI-6 is a member of the employee set, should be visible only at level S or above. 
The fact that Bond is infiltrating may be classified T so that the Bond record appears in 
both set. Such invisible super types help to preserve data confidential, (col. 10, lines 3- 
15). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to employ the teaching of Ananda with the teaching of 
Schaefer because many databases containing sensitive data are likely to be accessible 
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through a computer network or internet work, thereby exposing those databases to 
entities which may attempt to comprise the confidential of the sensitive data. 

As to claim 13, a method as recited in claim 1 , Ananda further discloses wherein 
said calculation expression is not explicitly defined for said at least one operation but 
said calculation expression is one that has been defined for another operation which 
has been considered as a related operation to said at least one operation, (col. 3, lines 
19-34). 

As to claim 14, Ananda further discloses a method as recited in claim 1 1 , 
wherein said calculation expression can be evaluated at least partly based on a value of 
at least one field of said at least one record, and wherein said calculation expression 
can be evaluated at least partly based on at least one state variable of said database, 
(col. 3, lines 19-34). 

As to claim 15, Ananda does not teach "a method as recited in claim 14, wherein 
said method further comprises: granting temporary or limited access to said at least one 
record to allow said evaluating of said calculation expression." 

However, Schaefer shows the record on "James Bond" may be visible at level U, 
and at level U we can see a set of "MI-6 employee". However, the fact the Bond works 
for MI-6 is a member of the employee set, should be visible only at level S or above. 
The fact that Bond is infiltrating may be classified T so that the Bond record appears in 
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both set. Such invisible super types help to preserve data confidential, (col. 10, lines 3- 
15). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to employ the teaching of Ananda with the teaching of 
Schaefer because password protection and access lists of user having permission to 
access a particular piece of data my be employed to prevent unauthorized retrieval of 
the sensitive data. 



8. Claims 10 and 32, are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Ananda (US 6385731 B2) in view of Shurt (US 5572673). 

As to claims 10 and 32, Anada does not disclose "a method as recited in claim 1, 
wherein access to said at least one record can be for browsing, editing, or deleting of 
said at least one record." 

However, Shurts shows the database is divided into two tables, a first 
"unclassified" table accessible to all customers and a second "secret" table inaccessible 
to most customers. The retailer sometimes grant the right access more sensitive 
information for the limited purpose of updating their price and other supply information, 
(col. 6, lines 35-col. 7, lines 2). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to employ the teaching of Ananda with the teaching of 
Shurts because the owner or administrator grants specified users permission to execute 
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specified commands and to access specified tables, views, and columns. So no one 
can update without the owner or the administrator permission. 



9, Claim 1 2 rejected under 35 U.S.C. 1 03(a) as being unpatentable over Ananda 
(US 6385731 B1 ) in view of Schaefer et al. (US 5826268) and further in view of Shurts 
(US 5572673). 

As to claim 12, Ananda and Schaefer do not disclose "a method as recited in 
claim 1 , wherein access to said at least one record can be for browsing, editing, or 
deleting of said at least one record." 

However, Shurts shows the database is divided into two tables, a first 
"unclassified" table accessible to all customers and a second "secret" table inaccessible 
to most customers. The retailer sometimes grant the right access more sensitive 
information for the limited purpose of updating their price and other supply information, 
(col. 6, lines 35-col. 7, lines 2). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to employ the teaching of Ananda with the teaching of 
Schaefer and further with the teaching of Shurts because the owner or administrator 
grants specified users permission to execute specified commands and to access 
specified tables, views, and columns. So no one can update without the owner or the 
administrator permission. 

Conclusion 
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10. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

McNabb et al. (US 6289462B1) shows trusted compartmentalized computer 
operating system. 

Lloyd (US 6460041 B1) shows browser-based database-access engine apparatus 
and method. 
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Commissioner of Patents and Trademarks 
Washington, D.C. 20231 

Any inquiry concerning this communication or earlier communications 
from the examiner should be directed to Tarn V Nguyen whose telephone number 
is (703) 305-3735. The examiner can normally be reached on 7:30AM-5: 00PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kim Yen Vu can be reached on (703) 305-4393. The fax phone numbers for 
the organization where this application or proceeding is assigned are (703) 746-7239 for 
formal communications and (703) 746-7240 for informal communications. 

Hand-delivered responses should be brought to Crystal Park II, 2121 Crystal 
Drive, Arlington, Virginia 22202. Fourth Floor (Receptionist). 

1 2. Any inquiry of a general nature or relating to the status of this application or 
proceeding should be directed to the receptionist whose telephone number is 703-305- 
3900. 
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